Takedown Evidence Kit

Takedown Evidence Kit is a local security tool for collecting takedown evidence from suspicious URLs and domains.

It is designed for phishing, fraud domain, brand impersonation, fake website, typosquatting, and suspicious redirect investigation workflows.

The tool collects technical evidence, creates a case folder, generates analyst-readable reports, and prepares draft messages for takedown or abuse reporting.

This tool does not send emails, submit reports automatically, brute force, exploit, or bypass authentication. Analyst review is required before using any generated report or draft.

Features

• URL normalization and registered domain extraction
• HTTP response collection
• Initial and final HTTP status tracking
• Redirect chain collection
• Cloudflare challenge detection
• HTTP headers and HTML capture
• Page title extraction
• Login form, password field, and form detection
• Brand keyword and suspicious keyword checks
• DNS record collection
• WHOIS lookup and domain age analysis
• SSL certificate inspection
• Browser-based screenshot capture with Playwright
• Browser final URL and page title capture
• Favicon hash collection and legitimate favicon comparison
• Triage scoring for analyst prioritization
• Markdown and JSON evidence exports
• Generic takedown / CERT report draft
• Registrar abuse email draft
• Hosting provider abuse email draft
• Optional Türkiye / USOM report draft

Output Files

Each investigation creates a case folder under cases/.

File	Description
technical_evidence.json	Full machine-readable evidence package
evidence_report.md	Human-readable technical evidence report
generic_takedown_report.md	English generic takedown / CERT / CSIRT report draft
cert_report_usom_tr.md	Optional Turkish USOM report draft
registrar_abuse_email.md	Registrar abuse email draft
hosting_abuse_email.md	Hosting provider abuse email draft
headers.txt	Captured HTTP headers
page.html	Captured HTML
screenshot.png	Browser screenshot
favicon.ico	Captured favicon, if available

Installation

The tool is primarily developed and tested on Ubuntu Linux.

Recommended WSL distribution: Ubuntu 24.04 LTS.

It should also work on macOS and Windows WSL. Native Windows PowerShell usage may work, but is not the primary test environment.

Ubuntu 26.04 is not currently recommended for this project because Playwright Chromium may fail on ubuntu26.04-x64 until upstream support is available.

Linux / macOS / WSL

git clone https://github.com/IV-JHIN/takedown-evidence-kit.git
cd takedown-evidence-kit

sudo apt update
sudo apt install -y python3 python3-venv python3-pip git

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
playwright install chromium

# If Playwright reports missing browser dependencies:
sudo playwright install-deps

Windows PowerShell Experimental

git clone https://github.com/IV-JHIN/takedown-evidence-kit.git
cd takedown-evidence-kit
py -m venv venv
.\venv\Scripts\Activate.ps1
pip install -r requirements.txt
playwright install chromium

Usage

Start the Streamlit app:

streamlit run app.py

Then open the local URL shown in the terminal.

Fill in:

• Suspicious URL
• Brand name
• Legitimate domain
• Customer / organization name
• Case ID
• Analyst notes

Click Start Evidence Collection.

Example Workflow

1. A customer reports a suspicious URL.
2. The analyst enters the suspicious URL and legitimate brand/domain.
3. The tool collects HTTP, DNS, WHOIS, SSL, screenshot, favicon, and page-analysis evidence.
4. The analyst reviews the generated reports.
5. The analyst manually submits the relevant report to a CERT/CSIRT, registrar, hosting provider, or internal abuse workflow.

Triage Score

The triage score is only an analyst prioritization aid. It is not a final abuse verdict.

Example labels:

• Low Signal
• Review Recommended
• No Active Web Evidence

The tool attempts to reduce false positives for legitimate same-domain login pages, legitimate subdomains, inactive domains, no-active-evidence cases, and redirect-only cases without credential collection evidence.

Sample Outputs

Sanitized mock outputs are available under sample_outputs/.

These files are safe examples and do not represent real customers, real phishing pages, or real takedown cases.

Safety Notes

Use this tool only for authorized security work.

Do not use it to attack systems, brute force, exploit vulnerabilities, bypass authentication, submit credentials to suspicious pages, send automated abuse reports, or publish real customer evidence.

Generated drafts must be manually reviewed before submission.

GitHub Safety

The repository is configured to ignore runtime evidence output:

cases/*
screenshots/*

Only .gitkeep files and sanitized mock samples should be committed.

Do not commit real customer cases, phishing screenshots, API keys, tokens, private evidence, or internal customer data.

Roadmap

• Urlscan.io integration
• VirusTotal URL scan integration
• Hosting provider / ASN detection
• Abuse contact discovery
• PDF export
• Docker support
• More CERT/CSIRT templates
• Better parked-domain detection
• Case timeline support

Disclaimer

This project is for defensive security, fraud investigation, and takedown evidence preparation.

It does not determine whether a domain is legally abusive, malicious, or infringing. Final decisions must be made by qualified analysts, affected organizations, service providers, CERT/CSIRT teams, registrars, hosting providers, or relevant authorities.